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IN THE CLAIMS : 

1 . (Currently Amended) A method for identifying spoofed emails, the method comprising the 
steps of: 

receiving an email addressed to a recipient in a first network, the email including a plurality 
of headers, wherein at least one of the plurality of headers includes a sender address; 

determining whether the sender address indicates a mailbox from within the first network; 

modifying the s e nd e r addr e ss if it when the sender address indicates a mailbox from within 
the first network , modifying at least a portion of the sender address so as to produce a modified 
sender address that indicates to the recipient that the email is associated with a mailbox that is 
external to the first network ; and 

sending the email with the modified sender address to the recipient , the modified sender 
address being visible to the recipient . 

2. (Previously Presented) The method of claim 1, wherein the receiving step comprises: 
receiving the email that includes a "sender" header field that includes the sender address. 

3. (Currently Amended) The method of claim 1, wherein the receiving step comprises: 
receiving the email that includes a "from" header field that includes the r e cipient's sender 

address. 

4. (Currently Amended) The method of claim 1, wherein the receiving step comprises: 
receiving the email that includes a "reply-to" header field that includes the sender address. 

5. (Currently Amended) The method of claim 1, wherein the step of determining comprises: 
determining whether the sender address matches any one of a plurality of domains and/or or 

sub-domains associated with the first network. 

6. (Currently Amended) The method of claim 5, wherein the step of modifying comprises: 
modifying the sender address i£it when the sender address matches any one of the domains 



^ 

and/or or sub-domains associated with the first network. 

7. (Previously Presented) The method of claim 1, wherein the step of modifying comprises: 
appending a predetermined sub-domain to the sender address. 

8. (Currently Amended) The method of claim 1, wherein the step of modifying comprises: 
modifying at least one of a domain and/or and a sub-domain of the sender address. 

9. (Currently Amended) The method of claim 1, further comprising: 

receiving a second email, the second email being from the recipient and being addressed to 
the modified sender address; 

modifying the modified sender address so as to r e turn it produce the sender address te4ts 
original form ; and 

sending the second email with the sender address . 

10. (Currently Amended) A tangible computer program product readable medium encoded with 
a program for identifying spoofed emails, the computer program product comprising[[:]] a storage 
m e dium readabl e by a proc e ssing circuit and storing instructions for e x e cution by th e proc e ssing 
circuit for performing a method comprising the steps of: 

receiving an email addressed to a recipient in a first network, the email including a plurality 
of headers, wherein at least one of the plurality of headers includes a sender address; 

determining whether the sender address indicates a mailbox from within the first network; 

modifying th e s e nd e r addr e ss if it when the sender address indicates a mailbox from within 
the first networ k, modifying at least a portion of the sender address so as to produce a modified 
sender address that indicates to the recipient that the email is associated with a mailbox that is 
external to the first network ; and 

sending the email with the modified sender address to the recipient , the modified sender 
address being visible to the recipient . 
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1 1 . (Currently Amended) The tangible computer program product readable medium of claim 1 0, 
wherein the receiving step of the method comprises: 

receiving the email that includes a "sender" header field that includes the sender address. 

1 2 . (Currently Amended) The tangible computer program product readable medium of claim 1 0, 
wherein the receiving step of the method comprises: 

receiving the email that includes a "from" header field that includes the r e cipi e nt's sender 
address. 

1 3 . (Currently Amended) The tangible computer program product readable medium of claim 1 0 5 
wherein the determining step of the method comprises determining whether the sender 

address matches any one of a plurality of domains and/or or sub-domains associated with the first 
network, and 

the modifying step of the method comprises modifying the sender address i£4t when the 
sender address matches any one of the domains and/or or sub-domains associated with the first 
network. 

14. (Currently Amended) The tangible computer program product readable medium of claim 1 0, 
wherein the modifying step of the method comprises: 

appending a predetermined sub-domain to the sender address. 

1 5 . (Currently Amended) The tangible computer program product readable medium of claim 1 0, 
wherein the modifying step of the method comprises: 

modifying at least one of a domain and/or and a sub-domain of the sender address. 

1 6 . (Currently Amended) The tangible computer program product readable medium of claim 1 0, 
wherein the method further comprises the steps of: 

receiving a second email, the second email being from the recipient and being addressed to 
the modified sender address; 
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modifying the modified sender address so as to r e turn it produce the sender address to its 
original form ; and 

sending the second email with the sender address . 

17. (Currently Amended) A computer system for identifying spoofed emails, the computer 
system comprising: 

a receiver receiving an email addressed to a recipient in a first network, the email including a 
plurality of headers, wherein at least one of the plurality of headers includes a sender address; 

a processor determining whether the sender address indicates a mailbox from within the first 
network, the processor modifying at least a portion of the sender address so as to produce a modified 
sender address that indicates to the recipient that the email is associated with a mailbox that is 
external to the first network ifit when the sender address indicates a mailbox from within the first 
network; and 

a transmitter sending the email with the modified sender address to the recipient , the 
modified sender address being visible to the recipient . 

18. (Previously Presented) The computer system of claim 1 7, wherein the receiver receives the 
email that includes a "sender" header field that includes the sender address. 

1 9. (Previously Presented) The computer system of claim 1 7, wherein the processor modifies the 
sender address by appending a predetermined sub-domain to the sender address. 

20. (Currently Amended) The computer system of claim 1 7, wherein the processor determines 
whether the sender address indicates a mailbox from within the first network by determining whether 
the sender address matches any one of a plurality of domains and/or or sub-domains associated with 
the first network, and 

the processor modifies the sender address by modifying the sender address i£4t when the 
sender address matches any one of the domains and/or or sub-domains associated with the first 
network. 



